You are viewing a single comment's thread.

view the rest of the comments →

bezzy ago

If malare is only in RAM then a simple reboot wipes it. Click farming malware is mostly used to generate ad revenue.

senpaithatignoresyou ago

Not on the ram. This was also on a unix machine, windows 7 and 10 machines too.

MR_CHNYD ago

I don't understand how you are unaware of where it resides yet you have it detected. Are you very IT savvy or not so much? Any more info appreciated.

senpaithatignoresyou ago

I would wager i am about a 2 out of 10 with IT. I am not nearly as tech savvy as i want to be. the more i work with it, the more i realize it is incredibly complex. The scary bit, is none of the corporate people bother to learn the basics of how their expensive networks operate.

Part of why i don't have that many details on this, is i am not working directly with the people who are responding to it. This is stuff i have overheard.

bezzy ago

What endpoint detection vendor/product detected it?

senpaithatignoresyou ago

crowdstrike

And if you want to enter a new world of creepy, that one would make 15 new topics here. IF your company uses it, **DONT'T **work from home.

10233264? ago

as in; DNC leaks—crowdstrike?

bezzy ago

We don't.

bezzy ago

Fileless means in RAM. There is no other place for data to be. Either it's on disk and therefore there are files or it is not and then it's in RAM. If data is not written to disk and does not exist in RAM, then where is it? In the cache? Search fileless malware. It's all about existing in ram and leveraging something like PS. The only way to achieve persistence across reboots is to write to a disk, at which point it isn't truly fileless.

WarGy ago

It could be in the CPU cache, couldn't it? There's also been a few cases of malware written into the BIOS flash memory.

bezzy ago

Perhaps, I don't know enough about CPUs. At any rate that would be a very tiny virus. If something is written to BIOS then it still is not fileless.